Access Dictionary
Two-factor authentication (2FA)
Definition
Two-factor authentication (2FA) requires a second proof of identity after the password, such as an app code.
Also called: 2FA, two-factor authentication, two factor authentication, MFA, multi-factor authentication
Why it matters for WordPress
Passwords leak. 2FA means the password alone should not open wp-admin. It is one of the highest-value controls for site owners and agencies.
How it shows up in practice
- Prompt for an authenticator code after password entry
- Recovery codes stored offline for lost devices
- Policies that require 2FA for Administrator (and ideally Editor)
What to do
- Enable 2FA for all privileged roles.
- Store recovery codes somewhere safe (not in the same password manager note as the password if you can help it).
- Prefer app-based TOTP over SMS when you have the choice.
- Pair 2FA with rate limits so stuffing still costs the attacker time.
Feature: Two-factor authentication.
Related terms
Nearby ideas in the dictionary
- Brute force A brute-force attack tries many passwords or tokens until one works, usually against the login form.
- Credential stuffing Credential stuffing replays usernames and passwords stolen from other breaches against your login.
- Phishing Phishing tricks people into handing over credentials or installing malware by impersonating a trusted party.
- Login protection Login protection is the set of controls that harden the WordPress login against bots and credential attacks.